Internal controls and SOX for enterprise buyers
Asked as “SOX compliance software”, and as “internal controls management tool”, on behalf of an enterprise B2B company. 48 first choices recorded across the direct, paraphrase, budget and scale prompts, twelve models each.
By buyer segment
The same question asked on behalf of a different buyer. Each standing is computed within its segment; they sit side by side and are never added together.
01The standing
Share is the count of first choices across the direct, paraphrase, budget and scale prompts, over all twelve models, for an enterprise B2B company. Ordered by share.
ProductFirst-choice shareNegative rateLabelsQuadrant
Show the three products at 0%, ordered by negative rate
Bars are the share of first choices, 0 to 100Every product with at least 10 labels here. Every product name links to its vendor page.
Head to head
Recommended versus criticized
Every product with at least 10 labels here, on both axes. The 30% line names a quadrant, not the verdict above: that one needs more than 40%.
Criticized challengerCriticized default
Negative label rate →
01
02
03
04
05
06
07
08
09
10
11Accepted challengerEndorsed leader
0%First-choice share → · lines at 30% share and 25% negative40%
Key
01AuditBoard25%
AuditBoard25%02MetricStream21%
MetricStream21%03Workiva12%
Workiva12%04Optro10%
Optro10%05ServiceNow Integrated Risk Management6%
ServiceNow Integrated Risk Management6%06SAP GRC4%
SAP GRC4%07Archer4%
Archer4%08Pathlock2%
Pathlock2%09Diligent One Platform0%
Diligent One Platform0%10IBM OpenPages0%
IBM OpenPages0%11Vanta0%
Vanta0%02What they warned about
Two of twelve models held their first choice under the paraphrase. Claude Haiku 4.5, GPT-5.4 mini, Perplexity Sonar, Mistral Small, DeepSeek V4 Flash, Llama 4 Maverick, Qwen 3.7 Flash, Kimi K2, GLM 4.7 FlashX and MiniMax M2.5 changed. A high negative share on a product with few labels is a warning. A low share on a product with many labels is salience, not sentiment.
Vanta54%
7 of 13 labels negative · 4 of 12 models · 1 hard negative
“**Avoid for Scale**: Mid-market tools (FloQast ~$25K; Vanta/Drata ~$20-25K) lack enterprise depth” Grok 4.1 Fast, budget prompt
MetricStream11%
4 of 36 labels negative · 4 of 12 models
“Opaque pricing, 12-month implementation timeline... Not recommended unless you truly need the full GRC suite.” DeepSeek V4 Flash, budget prompt
Microsoft Excel100%
3 of 3 labels negative · 3 of 12 models · 3 hard negative
“Spreadsheet‑Based “Control Registers” (Excel, Google Sheets, etc.) ... **Avoid** tools that are essentially spreadsheets” GLM 4.7 FlashX, negative prompt
Drata67%
6 of 9 labels negative · 3 of 12 models · 1 hard negative
“**Avoid for Scale**: Mid-market tools (FloQast ~$25K; Vanta/Drata ~$20-25K) lack enterprise depth” Grok 4.1 Fast, budget prompt
03What they cite
Citations exist only for the models that return a source list: twelve of the twelve in this edition, and all six flagship models on the expanded tier.
Sites the answers cite
62 of 72 answers in this category came back with a source list, from 12 of 12 models: citations where the model returns them, or the search results it consulted. 6 of those lists are Google grounding redirects that name no site and are left out of the counts. 886 links across 232 sites, every framing counted. Ranked by the number of answers carrying the site or page.
vendor site · Optro41 answers · 51 citations · 10 models
25 answers · 50 citations · 9 models
vendor site · Netwrix25 answers · 25 citations · 10 models
vendor site · HighRadius24 answers · 27 citations · 10 models
22 answers · 44 citations · 9 models
21 answers · 32 citations · 9 models
vendor site · Sprinto20 answers · 22 citations · 9 models
vendor site · RiskWatch18 answers · 23 citations · 8 models
17 answers · 25 citations · 9 models
vendor site · MetricStream16 answers · 23 citations · 7 models
15 answers · 15 citations · 7 models
14 answers · 15 citations · 8 models
Pages the answers cite
The ten pages named in the most answers, by full address. A page here is one the models returned with a recommendation, not one the index endorses.
25 answers · 10 models
23 answers · 10 models
21 answers · 10 models
19 answers · 8 models
19 answers · 9 models
17 answers · 9 models
15 answers · 7 models
11 answers · 8 models
11 answers · 6 models
10 answers · 7 models
04How they answered
Six framings of the same buying question, each sent to every model in a fresh session with search on. One row per model, so a row shows whether it held its answer under rewording, what it named when cost was the constraint, and what it argued against. Computed from the raw judge labels.
ModelDirect“What is the best SOX compliance software for an enterprise B2B company?”Paraphrase“Which internal controls management tool would you recommend to a large B2B company with thousands of employees?”Comparative“What are the top enterprise-grade internal controls tools and how do they differ?”Budget-constrained“What is the best SOX compliance software for a large company that needs predictable total cost across thousands of users?”Scale-constrained“We are a 5,000 person company with SSO, SOC 2 and procurement review requirements evaluating a SOX compliance software. What should we look at?”Negative“Which internal controls tools should a large enterprise avoid or be cautious about?”
Claude Haiku 4.5BlackLineno first choiceChangedAuditBoardBlackLineno first choicenothing named
Four alternatives
Archer, Diligent One Platform, HighRadius, PathlockFour alternatives
Archer, MetricStream, ServiceNow Integrated Risk Management, WorkivaTwo alternatives
Arvexi, AuditBoardGPT-5.4 miniDiligent Internal Controls / AuditOptroChangedDiligent Internal Controls, Oracle Risk Management and Compliance, SAP GRC, SAP Process Control, Workivaagainst: Oracle GRCServiceNow Integrated Risk Managementno first choicenothing named
One alternative
SAI360Two alternatives
LogicManager, TeamMate Controls / TeamMate AuditOne alternative
WorkivaGemini 3.5 FlashOptroOptroHeldagainst: Drata, VantaOptroagainst: MetricStreamWorkivaOptro, Workivaagainst: Confluence, Drata, Jira, Microsoft Excel, Secureframe, SharePoint Lists, Vanta
Three alternatives
Pathlock, ServiceNow Integrated Risk Management, WorkivaFive alternatives
HighRadius, MetricStream, Oracle Risk Management, SAP GRC, ServiceNow Integrated Risk ManagementFour alternatives
BlackLine, FloQast, ServiceNow Integrated Risk Management, WorkivaThree alternatives
Optro, SmartSuite, ZenGRCPerplexity SonarMetricStreamAuditBoardChangedAuditBoard, MetricStreamMetricStreamagainst: AuditBoard, Diligent One Platform, Onspring, Optro, Resolverno first choicenothing named
Three alternatives
IBM OpenPages, ServiceNow Integrated Risk Management, WorkivaThree alternatives
MetricStream, ServiceNow Integrated Risk Management, WorkivaFive alternatives
Diligent One Platform, IBM OpenPages, SAP GRC / SAP Audit Management, ServiceNow Integrated Risk Management, WorkivaOne alternative
WorkivaGrok 4.1 FastAuditBoardagainst: LogicGate Risk Cloud, OnspringAuditBoardHeldno first choiceagainst: Drata, VantaMetricStreamagainst: Drata, FloQast, Vantano first choiceagainst: Spreadsheets
Four alternatives
Diligent One Platform, MetricStream, SAP GRC, WorkivaThree alternatives
Archer, MetricStream, ServiceNow Integrated Risk ManagementSeven alternatives
Archer, AuditBoard, Diligent One Platform, LogicGate Risk Cloud, MetricStream, ServiceNow Integrated Risk Management, WorkivaThree alternatives
Optro, ServiceNow Integrated Risk Management, WorkivaMistral SmallMetricStreamAuditBoardChangedMetricStreamWorkivaagainst: MetricStreamno first choicenothing named
Two alternatives
AuditBoard, IBM OpenPagesOne alternative
ServiceNow Integrated Risk ManagementSeven alternatives
Archer, Diligent One Platform, Hyperproof, IBM OpenPages, LogicGate Risk Cloud, OneTrust GRC, SAP Audit ManagementOne alternative
Oracle GRCDeepSeek V4 FlashAuditBoard, Workivaagainst: FloQastAuditBoardChangedAuditBoardagainst: Sprinto, VantaOptroagainst: MetricStreamno first choicenothing named
Five alternatives
Diligent One Platform, MetricStream, Pathlock, SAP GRC, ServiceNow Integrated Risk ManagementFour alternatives
Archer, MetricStream, ServiceNow Integrated Risk Management, WorkivaSix alternatives
Archer, MetricStream, Pathlock, SAP Audit Management, ServiceNow Integrated Risk Management, WorkivaThree alternatives
Onspring, SmartSuite, WorkivaLlama 4 MaverickMetricStream, Pathlock, SAP GRCArcher, MetricStream, ServiceNow Integrated Risk ManagementChangedno first choiceAuditBoard, MetricStream, Resolver, SAP GRCno first choicenothing named
Qwen 3.7 FlashMetricStreamAuditBoardChangedagainst: ArcherAuditBoardagainst: ArcherWorkivaAuditBoardagainst: AppSheet, Google Sheets, Microsoft Excel, Outlook, PowerApps, Slack, WhatsApp, iCloud
Four alternatives
Diligent Boards + GRC, Riskonnect, ServiceNow Integrated Risk Management, WorkivaTwo alternatives
Diligent One Platform, ServiceNow Integrated Risk ManagementFive alternatives
Diligent One Platform, Drata, OneTrust GRC, SAP GRC, ServiceNow Integrated Risk ManagementTwo alternatives
MetricStream, ServiceNow Integrated Risk ManagementFour alternatives
BlackLine, Diligent One Platform, Vena, WorkivaKimi K2AuditBoardMetricStreamChangedAuditBoardFloQastagainst: BlackLineno first choicenothing named
Three alternatives
Diligent One Platform, MetricStream, WorkivaThree alternatives
SAP GRC, ServiceNow Integrated Risk Management, WorkivaNine alternatives
Archer, Hyperproof, LogicGate Risk Cloud, MetricStream, Oracle GRC, SAP GRC, ServiceNow Integrated Risk Management, Vanta, WorkivaTwo alternatives
AuditBoard, WorkivaGLM 4.7 FlashXAuditBoard, WorkivaServiceNow Integrated Risk ManagementChangedno first choiceOnspringagainst: MetricStreamno first choiceagainst: Google Sheets, Microsoft Excel
Five alternatives
BlackLine, Diligent One Platform, FloQast, Pathlock, SAP GRCThree alternatives
Archer, Diligent One Platform, WorkivaFour alternatives
AuditBoard, Drata, Hyperproof, VantaMiniMax M2.5AuditBoard, MetricStreamArcherChangedno first choiceagainst: Drata, VantaFloQastagainst: AuditBoard, BlackLine, Drata, Hyperproof, Vanta, Workivano first choicenothing named
Two alternatives
Diligent One Platform, RiskWatchTwo alternatives
Hyperproof, ServiceNow Integrated Risk ManagementBold is the first choiceAlternatives are counted; the count opens them.What the answer argued against
05The record
One row per call: the version string exactly as returned, whether the model searched, sources cited, and latency. Full answer text is in the free responses file. Download the record
Seventy-two rows: every prompt, every model, every answer.
| Prompt | Model | Version string | Time (UTC) | Searched | Sources | Latency |
|---|---|---|---|---|---|---|
| Direct recommendation | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 19:57 | yes | 9 | 9 s |
| Direct recommendation | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 19:27 | yes | 3 | 7 s |
| Direct recommendation | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 19:57 | yes | 14 | 23 s |
| Direct recommendation | Perplexity Sonar | sonar | 2026-09-17 18:26 | yes | 20 | 7 s |
| Direct recommendation | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 17:58 | yes | 27 | 16 s |
| Direct recommendation | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 21:06 | yes | 19 | 10 s |
| Direct recommendation | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 19:42 | yes | 15 | 22 s |
| Direct recommendation | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 20:32 | yes | 5 | 3 s |
| Direct recommendation | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 18:52 | yes | 8 | 35 s |
| Direct recommendation | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 18:09 | yes | 10 | 41 s |
| Direct recommendation | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 20:49 | yes | 20 | 105 s |
| Direct recommendation | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 19:37 | yes | 10 | 27 s |
| Paraphrase | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 20:03 | no | 0 | 5 s |
| Paraphrase | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 19:52 | yes | 3 | 6 s |
| Paraphrase | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 18:48 | yes | 16 | 21 s |
| Paraphrase | Perplexity Sonar | sonar | 2026-09-17 19:17 | yes | 17 | 5 s |
| Paraphrase | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 18:35 | yes | 26 | 16 s |
| Paraphrase | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 18:23 | yes | 5 | 3 s |
| Paraphrase | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 20:52 | yes | 24 | 34 s |
| Paraphrase | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 20:54 | yes | 5 | 3 s |
| Paraphrase | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 20:34 | no | 0 | 29 s |
| Paraphrase | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 18:39 | yes | 15 | 20 s |
| Paraphrase | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 20:11 | yes | 26 | 60 s |
| Paraphrase | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 19:55 | yes | 5 | 22 s |
| Comparative | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 20:40 | yes | 18 | 10 s |
| Comparative | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 20:29 | yes | 6 | 11 s |
| Comparative | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 19:02 | yes | 9 | 28 s |
| Comparative | Perplexity Sonar | sonar | 2026-09-17 21:00 | yes | 19 | 14 s |
| Comparative | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 18:25 | yes | 33 | 20 s |
| Comparative | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 20:14 | yes | 13 | 11 s |
| Comparative | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 18:21 | yes | 20 | 27 s |
| Comparative | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 18:48 | yes | 5 | 2 s |
| Comparative | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 19:47 | no | 0 | 32 s |
| Comparative | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 20:10 | yes | 25 | 60 s |
| Comparative | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 20:17 | yes | 26 | 113 s |
| Comparative | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 20:09 | yes | 12 | 43 s |
| Budget constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 20:39 | yes | 15 | 10 s |
| Budget constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 18:03 | yes | 0 | 4 s |
| Budget constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 20:08 | yes | 26 | 31 s |
| Budget constrained | Perplexity Sonar | sonar | 2026-09-17 18:11 | yes | 15 | 8 s |
| Budget constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 21:09 | yes | 34 | 24 s |
| Budget constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 18:32 | yes | 22 | 16 s |
| Budget constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via deepinfra | 2026-09-17 18:32 | yes | 24 | 67 s |
| Budget constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 18:11 | yes | 5 | 3 s |
| Budget constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 19:59 | yes | 10 | 49 s |
| Budget constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 18:21 | yes | 9 | 19 s |
| Budget constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 19:54 | yes | 27 | 67 s |
| Budget constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 20:00 | yes | 16 | 47 s |
| Scale constrained | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 19:31 | yes | 18 | 11 s |
| Scale constrained | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 18:25 | no | 0 | 7 s |
| Scale constrained | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 20:00 | yes | 6 | 21 s |
| Scale constrained | Perplexity Sonar | sonar | 2026-09-17 19:56 | yes | 20 | 11 s |
| Scale constrained | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 19:18 | yes | 15 | 22 s |
| Scale constrained | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 20:43 | no | 0 | 9 s |
| Scale constrained | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 18:16 | yes | 26 | 34 s |
| Scale constrained | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 20:34 | yes | 5 | 3 s |
| Scale constrained | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 19:25 | no | 0 | 37 s |
| Scale constrained | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 19:59 | yes | 13 | 44 s |
| Scale constrained | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 20:03 | yes | 14 | 41 s |
| Scale constrained | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 18:53 | no | 0 | 48 s |
| Negative framing | Claude Haiku 4.5 | claude-haiku-4-5-20251001 | 2026-09-17 19:25 | yes | 18 | 11 s |
| Negative framing | GPT-5.4 mini | gpt-5.4-mini-2026-03-17 | 2026-09-17 20:16 | no | 0 | 6 s |
| Negative framing | Gemini 3.5 Flash | gemini-3.5-flash | 2026-09-17 18:02 | yes | 21 | 32 s |
| Negative framing | Perplexity Sonar | sonar | 2026-09-17 19:51 | yes | 20 | 5 s |
| Negative framing | Grok 4.1 Fast | spacexai/grok-4.1-fast-non-reasoning via vertex | 2026-09-17 21:03 | yes | 36 | 22 s |
| Negative framing | Mistral Small | mistral/mistral-small via mistral | 2026-09-17 18:19 | yes | 5 | 6 s |
| Negative framing | DeepSeek V4 Flash | deepseek/deepseek-v4-flash via fireworks | 2026-09-17 20:19 | yes | 10 | 15 s |
| Negative framing | Llama 4 Maverick | meta/llama-4-maverick via bedrock | 2026-09-17 18:40 | yes | 5 | 4 s |
| Negative framing | Qwen 3.7 Flash | alibaba/qwen3.7-flash via alibaba | 2026-09-17 19:54 | no | 0 | 33 s |
| Negative framing | Kimi K2 | moonshotai/kimi-k2 via novita | 2026-09-17 18:36 | yes | 24 | 61 s |
| Negative framing | GLM 4.7 FlashX | zai/glm-4.7-flashx via zai | 2026-09-17 18:44 | yes | 26 | 121 s |
| Negative framing | MiniMax M2.5 | minimax/minimax-m2.5 via minimax | 2026-09-17 17:59 | yes | 5 | 57 s |
Normalization in this category
Every judgment call made between the raw labels and the numbers above, listed so it is visible and reversible.
Category-scoped readings
Diligent read as Diligent One Platform
Diligent (HighBond) read as Diligent One Platform
Diligent (formerly HighBond / OnControl) read as Diligent One Platform
Diligent (formerly HighBond/Diligent Boards) read as Diligent One Platform
Excel read as Microsoft Excel
IBM read as IBM OpenPages
LogicGate read as LogicGate Risk Cloud
Netwrix read as Netwrix Auditor
OneTrust read as OneTrust GRC
OneTrust (Risk Manager) read as OneTrust GRC
ServiceNow read as ServiceNow Integrated Risk Management
ServiceNow GRC read as ServiceNow Integrated Risk Management
ServiceNow GRC (Integrated Risk Management) read as ServiceNow Integrated Risk Management
Unresolved, counted raw
AppSheet
Bead AI
Confluence
Deloitte's Compliance Dashboard
Diligent Boards + GRC
Diligent Internal Controls
Diligent Internal Controls / Audit
Oracle Risk Management
Oracle Risk Management and Compliance
Outlook
PowerApps
Saviynt
SharePoint Lists
SoftComply
TeamMate Controls / TeamMate Audit
iCloud
Discontinued, still offered
No shut-down product was recommended here.